Before this commit, the memory access within `do_init_enclave` setting
`g_enclave_state` to `ENCLAVE_INIT_DONE` was entirely unsynchronized.
This could cause the compiler to reorder this access, performing it
earlier than actually written. This would effectively unlock the memory
being initialized for use within other threads before the initialization
is finished.
The issue isn't entirely theoretical, as such an optimization could for
example allow to make one of the calls to `memset_s` a tailcall. The
only thing preventing this is the difficulty of proving that the memset
doesn't alias `g_enclave_state`.
One way to fix this would be to access `g_enclave_state` with C11
atomics of ordering `acq_rel` or stronger. However, the freestanding
environment of the SDK doesn't support C11 atomics. Thus we use the
existing assembly wrappers, which are sufficient as achieving `acq_rel`
semantics in x86 assembly doesn't require any special instructions.
To make it less likely that a similar flaw is reintroduced, we remove
the `extern` declaration of `g_enclave_state` from the header files.
Signed-off-by: Maja Kądziołka <maya@invisiblethingslab.com>
Added support for Reproducible Enclave Build using Docker file.
Added support for Intel AVX-512 instructions and Intel SHA Extensions New Instructions (SHA-NI) in trusted libraries.
Support both EPID and ECDSA based quote for quoting related interfaces in sgx_uae_service library.
Updated key exchange library to support both EPID and ECDSA based remote attestation.
Support new interface to check platform information blob from remote attestation response message.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added new APIs in sgx_uae_service.h and sgx_ukey_exchange.h to support ECDSA quote based remote attestation.
The set of legacy APIs supports EPID only and the set of new APIs supports ECDSA quotes.
Enhanced Edger8r with structure deep-copy feature.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Maja Kądziołka